A Bad Week for the Web: What’s Confirmed and What to Do

Three separate security incidents hit three different parts of the stack in one week: PHP2Shell, the Railway environment variable breach, and eMudhra's compromised certificate authority keys. Here's what happened, what's actually confirmed, and what you need to do, if anything. As promised, the incident numbers and dates are below. Facts as of October 23, 2026. These stories are still moving, so check the sources for updates. PHP2SHELL - CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) - CVSS v4.0 9.2, Critical. The 10.0 going around came from the leak, not from PHP. - Unauthenticated remote code execution in PHP itself, affecting versions back to 5.4 - Oct 17: Amazon saw the first exploitation attempt on its honeypots - Oct 20: details leaked ahead of the planned Oct 22 disclosure - Oct 21: fixes released and CISA published an alert - Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. One-time source patches exist for 7.4, 8.0 and 8.1. - No confirmed break-ins reported as of Oct 22 - Found by Wiz Research, Calif and OpenAI's security team NODE.JS - Oct 21: security release fixing 10 CVEs - CVE-2026-111497: Brotli decompression flaw, rated High, no workaround - Fixed in Node 22.23.4, 24.22.1 and 26.12.1. The same release blocks the eight eMudhra intermediates. RAILWAY - Status page incident QH8L8B3E - Oct 21: Railway disclosed that an unauthorized party got into the systems that store customer environment variables and, for some customers, obtained the decrypted values. Builds and deploys were paused. - Oct 22: builds back for Pro and Enterprise (06:29 UTC) and Hobby (21:08 UTC) - Oct 23: builds and deployments running normally on every plan, including Free and Trial (08:09 UTC update) - Earlier platform incidents: Vercel (disclosed Apr 19, 2026) and OpenCode (Oct 17, 2026). Nobody has said it's the same attackers. EMUDHRA - Mozilla Bugzilla 2083449 - Eight intermediate CA private keys were recoverable: six for TLS, two for code signing. They were generated on Apr 30, 2025 by a broken key generation step, and one private key was literally the number 4. - Oct 17: reported to the browsers. Chrome blocked the intermediates at 19:45 UTC and Mozilla's block was in place by 22:59 UTC. - Oct 20: made public, and Firefox 158.0.1 removed the emSign ECC Root CA - G3 root - Oct 22: eMudhra said it will leave the SSL/TLS certificate business - Oct 27: Chrome removes emSign ECC Root CA - G3 WHAT TO DO - PHP: update to a fixed version. On a Linux distro the version number may not change, so check your distro's security advisory, then restart PHP so the workers pick up the fix. - Node: update to 22.23.4, 24.22.1 or 26.12.1 - Railway: revoke the old keys at the provider first, create new ones, then update Railway and redeploy. Rotate every secret, not just the ones you think were exposed. - Everyone: use a separate API key for every app, set spending limits and alerts, and check your OpenAI and Anthropic usage dashboards for unfamiliar models or sudden spikes. - eMudhra: for most people, nothing. Keep your browser and OS updated. If you have a cert that chains to emSign ECC Root CA - G3, replace it before Oct 27. TIMESTAMPS 0:00 Intro 1:25 PHP2Shell: what happened 1:52 Two ways to run PHP 2:44 It's a 9.2, not a 10 3:26 The 70% claim 3:54 Who found it, and AI's role 4:29 A messy patch 5:09 What to do about PHP 6:20 Node.js security release 7:01 Railway breach 7:55 Rotate or stay down 8:18 Why AI keys are the target 9:02 A stolen key is a credit card 9:25 What to do about Railway 9:54 Tips for everyone 10:32 eMudhra: 8 compromised CA keys 10:47 How the certificate chain works 11:39 Not a hack: tiny keys 12:20 The browser response and what to do 12:41 Wrap up: what ties it together 13:08 The fair pushback SOURCES PHP security advisory: https://www.php.net/archive/2026.php#2026-10-21-5 CISA alert: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching Node.js security releases: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases Railway status, incident QH8L8B3E: https://status.railway.com/incident/QH8L8B3E Google on the eMudhra intermediates: https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/ Mozilla Bugzilla 2083449: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449 Scott Helme on recovering the keys: https://scotthelme.co.uk/eight-bits-of-trust-emudhras-ca-keys-cracked-in-milliseconds/